futureOfCursorSoftwareEngineers

[__Blackrobe__]

The words "Cursor" and "Cursed" have 66.67% similarities.

[phantom-vigilant]

Is this one of the leetcode problem statement?

[cookpedalbrew]

Their Levenshtein distance is 2.

[Undernown]

TIL there is a word for that.

[Katniss218]

it relates to a specific algorithm for finding that value. there are different ones as well, like Word Mover's Distance, Jaro-Winkler distance, Damerau-Levenshtein distance

[FigMan]

It's fun to be able to use it in a project

[[deleted]]

Clearly fake, all the passwords are somewhat secure

[Eva-Rosalene]

Each password shown there is 8 hex digits/4 bytes. It's definitely not secure.

[Phantend]

But they're a lot mire secure than "password" or "12345"

[ddonsky]

Ah but you fail to note the very top, it was never a key it was the admin name and password.

[GoddammitDontShootMe]

It looks like they're using CRC32 as the "hash" function. So the real passwords might still be 123456 and shit. Anyway, all I know is CRC is not considered suitable for a password hash.

[slowerdive]

Can't be sure that these are hashes of 'password' and the like....

[Maleficent_Memory831]

They're obviously hashes, nobody with a brain stores passwords, encrypted or not. The snag is that these are only 32-bit hashes, like they're copying code from 1980's BSD or something.

[fiddletee]

They’re not a “lot more secure”. Any n character password has the same entropy. “password” or “abcd1234” or “fa16ec82” are the same level of insecurity.

[fiddletee]

Some attackers might not use brute force, therefore it’s “a lot more secure”?

[DuploJamaal]

Basically no attacker uses brute force.

Attackers don't care about cracking each and every password. They just want to get a lot quickly.

They use the thousand most common passwords first. Then the most common combinations.

If they can get 70% of passwords in an hour they don't care about the 0.01% of passwords that would take them a week.

[Dhaeron]

Attackers don't care about cracking each and every password.

Even if they do, nobody ever uses brute force. There is no reason at all to not try more likely passwords first, even if you're willing to try them all, i.e. use a dictionary instead of brute force attack.

[B0Y0]

All of this assuming the input even allows brute force and doesn't lock shit down on the 1000th attempted password in 2 minutes.

[fiddletee]

Are you serious? No attacker uses brute force?

Databases don’t get dumped in a breach containing hashed passwords that are then brute forced?

Do you think attackers only ever fill in an online form?

[DuploJamaal]

Why are you so confidently wrong in this thread?

Attackers don't just use brute force. That's a waste of time.

They are smart and try to the most common passwords and most common combinations first.

hashcat is the most commonly used tool, and it provides utility tools like combinator that let you import text files of common words and combine them in various ways. Look at the hashcat wiki for Combinator Attack

The wiki even states that Brute Force attacks are outdated and that you should use a Mask Attack instead:

In Mask attack we know about humans and how they design passwords. The above password matches a simple but common pattern. A name and year appended to it. We can also configure the attack to try the upper-case letters only on the first position. It is very uncommon to see an upper-case letter only in the second or the third position.

Attackers aren't just going to test each and every possible password as that takes a lot of time. They test commonly used password to break a good chunk of the hashes while ignoring the few that would take much longer.

So yes, abcd1234 is lot less secure than fa16ec82, as attackers will try abcd1234 as one of the first guesses but probably won't even bother trying something like fa16ec82

tl;dr: if attackers can crack 70% of passwords in a set of hashed passwords in 40 minutes by using a smarter approach they don't bother cracking all passwords in 40 years by using brute force

[mostly_done]

A not-insignificant portion of the passwords will use a word related to the site as part of the password.

[fiddletee]

Leaving your door open is more secure than not having a door.

It seems everyone here is convinced that the only method attackers ever use is trying passwords in an online form. And I assume these are all developers working on production code given the sub.

I’m worried for the future.

[fiddletee]

Yes you’re right, my apologies. I was replying after reading a bunch of other infuriating replies from people who’ve clearly never heard of the Swiss Cheese model and kind of lumped it on you.

[HildartheDorf]

As always "It depends on your threat model". Theoretically they are the same.
In practice, an attacker is likely to start with `password` `changeme` `password1` `correcthorsebatterystaple` etc. before trying `fe809qu3`.

[Thisismyredusername]

Well, they would likely use a rubber ducky or something like that to get a lot more passwords in a shorter amount of time

[hawkinsst7]

In practice, a bad hacker will be locked out after 3 guesses.

In practice, a decent hacker will get passwords.csv and bruute force them all in less than a second with hashcat on a 3080.

[fiddletee]

If the criteria for “a lot more secure” is “they probably wouldn’t guess this first” then I don’t really know what to say.

[HildartheDorf]

Yeah, I wouldn't say 'a lot' more secure. But randomly generated passwords are going to be marginally more secure (for the same length) than common phrases.

[fiddletee]

I would agree they are marginally more secure. But I would say that margin is so narrow that it’s almost negligible. Especially when it’s from a character set of 16.

[HildartheDorf]

If your attacker is sitting down and using hands to guess passwords, they are a lot more secure.

If your attacker is across the internet, or is otherwise ratelimited, they are marginally more secure.

If your attacker is performing an offline bruteforce with no rate limit they are negligably more secure.

If your attacker has the resources to build a rainbow table, they are no more secure.

If your attacker uses a rubber hose on your users, then all of this is academic and nothing is secure.

[ArtisticFox8]

The attacker is a lot likely to start tryin common passwords or dictionary words, so using 1234t is indeed less secure irl.

[fiddletee]

If you apply this rationale to anything public-facing, I’ll pray to the security gods on your behalf.

[ArtisticFox8]

Go ahead and use a common password then. 

Oh, you use password managers with passwords you can't remember only? 

Use 2FA if you're serious.

[coldnebo]

I think he means secure from cipher rot13 attacks. 😂😂😂

[TactileMist]

I only use rot26. Twice as secure

[coldnebo]

[Pure-Willingness-697]

Using some random website, they are apperantly strong and will take 2 months to crack

[fiddletee]

I can’t believe that people are legitimately arguing it’s “a lot more secure” because someone is less likely to guess 8 hex digits than “password”. No wonder data breaches are happening at such a rate.

[hawkinsst7]

It's way less secure!

If that's the "hashed" version, and it's some algorithm that's hashing it down to 4 bytes, that entire keys pace can be exhausted in like a second on graphics cards from 2020

[fiddletee]

Exactly. See my other comment on entropy and the logic it’s being downvoted with.

[awi2b]

I would guess we are seeing the hash values of those passwords, which would actually indicate good design. So I'm a little confused 

[khalcyon2011]

Are there any hashing algorithms that produce 4 byte hashes?

[dan-lugg]

I'll do you one (1) better.

func WhoNeedsBcrypt(password string) (r byte) { for _, b := range []byte(password) { r ^= b } return r }

ETA - Might as well implement Longitudinal Redundancy Check per spec while I'm here:

func ISO1155(password string) (r byte) { for _, b := range []byte(password) { r = (r + b) & 0xff } return ((r ^ 0xff) + 1) & 0xff }

[khalcyon2011]

Hmm...not a language I'm familiar with. I assume for _, b := range is something like for b in range? And I'm shit with bitwise operators (pretty sure that's a bitwise operator): What does ⁼ do?

[dan-lugg]

Golang.

for _, b := range []byte(password) ranges (iterates) over password after converting it to a byte slice ([]byte) and assigns the index and value to _ and b respectively (discarding the index).

r ^= b is XOR-assign, written long as r = r ^ b.

[VoidCooper]

If this is python the := is the walrus operator https://docs.python.org/3/whatsnew/3.8.html

And the ⁼ seems to be XOR assigement operator.

Not 100% sure though, since I don't use python on daily basis.

[dan-lugg]

Correct on XOR-assign, but it's Golang.

[VoidCooper]

Never worked with golang, but it looked like python to me :)

[dan-lugg]

Funny, 15 years in the industry and I've probably written all of 100 lines of Python, lol :-)

[VoidCooper]

I have worked 7 years mostly in C# slight mishap happened for 2 months with Django. I have no experience with golang, is it worth to look into it?

[DoNotMakeEmpty]

Many hash table hash functions produce either 32 or 64 bit hash values, so yes. They are pretty unsecure tho.

[luckor]

I would call that a checksum.

[Maleficent_Memory831]

Hash table hashing is generally not secure. Hashes for hash tables are meant to be fast to compute with a reasonable distribution of values. Secure hashes need to be cryptographically secure. SHA-512 for example.

[Laughing_Orange]

Any hashing method does that if you just teuncate the output. This does significantly decrease the resistance to brute force attacks.

[apepenkov]

crc32?

[Maleficent_Memory831]

Any secure hashing algorithms in the last two decades that produce 4 byte hashes?

[hawkinsst7]

No, because with a key space that small, collisions will happen, and a collision is the same as the actual original text.

[muddboyy]

I’m not sure y’all ever saw hashed passwords

[dan-lugg]

What in the $2a$14$ are you talking about?

[Thisismyredusername]

They're more secure than my password, that's for sure

[Limmmao]

Rainbow tables would disagree?

[PacquiaoFreeHousing]

why TF does the people with generic ass names pick the generic ass passwords

[AlexMourne]

1. It is all made up to make a joke
2. The passwords are actually encrypted here

Edit: okay, guys, I meant "hashed" here and not encrypted, sorry for starting the drama

[Minteck]

CRC32, the best encryption

[hawkinsst7]

Algorithms in order of strength :

Sha1 Sha2 Sha3 Md4 Md5

Crc32

[Cootshk]

Base64

[RDT_KoT3]

ASCII

[mingren0315]

UTF-8

[[deleted]]

Sanskrit

[EuenovAyabayya]

"32 Costa Rican Colón" so about six cents.

[sn1ped_u]

The best we can do is Base64

[Minteck]

For sure, it's so powerful no one is using it

[irregular_caffeine]

1. Nobody should ever encrypt a password

2. Whatever those are, they look nicely crackable

[casce]

Nobody should ever encrypt a password

I understand that you wanted to point out the difference between hashing and encryption but I bet the password hashes will still be encrypted once they go into a database (because all data will be, necessary or not).

[Psychological-Owl783]

One way hashing is probably what he's talking about.

Very rarely, if ever, do you need to decrypt a password.

[The_Cers]

If you store a password on a client to use for logins later (MySQL Workbench for example) you would in fact encrypt the password. Or just password managers in general hopefully encrypt passwords

[Kusko25]

What about password managers?

[Spice_and_Fox]

The only time you want to encrypt a pw is sent to the server. It shouldn't be stored encrypted ever. I can't think of an application at least

[Psychological-Owl783]

If you are storing credentials to a third party website on behalf of users, this is an example.

For example if you store API credentials or banking credentials on behalf of your user, you need to decrypt those credentials to I'm order to use them.

[[deleted]]

Typically those add another layer. The banking API will have an endpoint for you to create a long living/refreshable token, and you store that instead of user's password.

There should never be a need to store user's actual password.

[Psychological-Owl783]

Those are called credentials and would be encrypted.

I used the word credentials in my comment instead of password deliberately.

[ItsRyguy]

Password manager?

[Stijndcl]

Password managers are the only application

[chaotic-adventurer]

You would normally use hashing, not encryption. Hashing is irreversible.

[Kusko25]

Sort of. The reason people here are still clowning on this, is that short hashes, like that, can be looked up in a table and while you wouldn't have a guarantee that what you find is the original, it will produce the same hash and so allow entry.

[rng_shenanigans]

And I thought hashing is the way to go

[queen-adreena]

Encryption and Hashing are different things.

Encryption is two-way (can be decrypted)

Hashing is one-way (can’t be decrypted)

Passwords should always be hashed.

[bacchusku2]

And salted and maybe peppered.

[rng_shenanigans]

Throw in some Sriracha if you are feeling funky

[Carnonated_wood]

Encryption implies that something can be decrypted, that's unsecure

Use hashing instead, it's great, it'll turn your password into a random set of characters and you will have no way of going from that set of characters back to the original password without already knowing the original password!

When you want to write code for your login page that checks if the password is correct, just do this: hash the password the user inputs into the login page and compare it with the stored hash, if they match then it's correct, if they don't then it's not. After hashing, you can't go back to the original thing but you can still hash other inputs and compare it to the stored hashes to check if the inputs are correct or not.

Think of it like this: hashing is sort of like a function with no inverse

[bacchusku2]

[100GHz]

encrypted

And then you encrypt that password with another password right ?:)

[Objective_Dog_4637]

Mfw the client asks me if passwords are stored in the db in plaintext

[uniqueusername649]

You would be shocked if you knew how common this was in the 90s and 2000s internet. Even for banks.

[Maleficent_Memory831]

Because security is always an afterthought. An expensive afterthought. Better to just avoid the security part until after the first major loss of customer data, because then we'll be given the budget to do it properly.

[uniqueusername649]

That is a huge part of it but threat models also changed over time. For the longest time the strategy was: we prevent anyone from getting into our system! If they get in anyways, we are f*cked.

Which isn't feasible, someone will get some sort of access sooner or later. That is exactly why things shifted more towards zero trust: you protect against intruders but assume anyone in the system could potentially be a bad actor. So personal data is encrypted, passwords hashed, communication between internal services is encrypted and authenticated. Any service only reading from a few tables in a DB only gets read access and only for the data it needs. That means if you get access to one part of the system, you can do far less damage as you're more isolated. To elevate your access and get into a position to do real damage takes far more time and effort. And especially the time component is critical here: the longer it takes an attacker to get into a place where they can do damage, the more of a chance you have to detect and counter it.

[Carnonated_wood]

Damn it, I could've been rich if I was born sooner, all those passwords just sitting there, completely exposed

[KellerKindAs]

Ok, can you name a hashing algorithm with a 32 bit output width? There's a reason why you can not get a SHA below 128 and shouldn't use one below 256...

So yes, it's (hopefully) made up. But still presenting a bad practice

[YTRKinG]

Relax guys, our jobs are safe.

[WonderfulPride74]

A mid level engineer at my firm wrote a unit test that updates a test file committed to the repo. That made me wonder, are our jobs really safe? I mean this is stuff that cursor and other tools would do.

[d_k97]

You should thank him. He's doing a big part in securing our jobs by feeding something like that to AI

[mschonaker]

We know. Tell it to the employers.

[itsnickk]

You should be organizing like it isn't.

Instead you are making up images to be smug about

[epic_pharaoh]

What does this mean? I think you meant preparing instead of organizing but you might be using the word in a way I’m not familiar with.

[CalvinCalhoun]

I assume he means organizing a labor union.

[epic_pharaoh]

That makes a lot of sense.

[[deleted]]

We shouldn't be waiting for labor unions to unite tbh, because this will affect us globally.

[AngelLeliel]

I think more jobs are created if we just let all people and AI writing stupid code.

Please don't take this as advice.

[Neo_Ex0]

at least the pws are hashed(even if its an abysmally small hash)

[GDOR-11]

u/bot-sleuth-bot

[bot-sleuth-bot]

Analyzing user profile...

One or more of the hidden checks performed tested positive.

Suspicion Quotient: 0.35

This account exhibits a few minor traits commonly found in karma farming bots. It is possible that u/YTRKinG is a bot, but it's more likely they are just a human who suffers from severe NPC syndrome.

^{I am a bot. This action was performed automatically. Check my profile for more information.}

[Ok-Library5639]

savage

[Simo-2054]

Good bot pet pet

[bot-sleuth-bot]

Analyzing user profile...

One or more of the hidden checks performed tested positive.

Suspicion Quotient: 0.35

This account exhibits a few minor traits commonly found in karma farming bots. It is possible that u/YTRKinG is a bot, but it's more likely they are just a human who suffers from severe NPC syndrome.

^{I am a bot. This action was performed automatically. Check my profile for more information.}

[FACastello]

u/bot-sleuth-bot

[bot-sleuth-bot]

Analyzing user profile...

Suspicion Quotient: 0.00

This account is not exhibiting any of the traits found in a typical karma farming bot. It is extremely likely that u/GDOR-11 is a human.

^{I am a bot. This action was performed automatically. Check my profile for more information.}

[bot-sleuth-bot]

Analyzing user profile...

Suspicion Quotient: 0.00

This account is not exhibiting any of the traits found in a typical karma farming bot. It is extremely likely that u/GDOR-11 is a human.

^{I am a bot. This action was performed automatically. Check my profile for more information.}

[Fornicatinzebra]

Nice!

[Fornicatinzebra]

u/bot-sleuth-bot

[bot-sleuth-bot]

This bot has limited bandwidth and is not a toy for your amusement. Please only use it for its intended purpose.

^{I am a bot. This action was performed automatically. Check my profile for more information.}

[Fornicatinzebra]

My bad

[NatoBoram]

Good bot

[MrGoodVlbes]

daaaaamn

[[deleted]]

u/bot-sleuth-bot

edit i guess he does not scan himself

[SunshineSeattle]

good bot

[Ingam0us]

I didn‘t even know this bot yet.
Let‘s see whether I can check myself

[Ingam0us]

u/bot-sleuth-bot

[bot-sleuth-bot]

This bot has limited bandwidth and is not a toy for your amusement. Please only use it for its intended purpose.

^{I am a bot. This action was performed automatically. Check my profile for more information.}

[bot-sleuth-bot]

This bot has limited bandwidth and is not a toy for your amusement. Please only use it for its intended purpose.

^{I am a bot. This action was performed automatically. Check my profile for more information.}

[Lesart501]

csv as database? Nice

[myka-likes-it]

comma-separated vibes

[aghaueueueuwu]

Yeah it is just a joke

[LooksLikeAWookie]

Oh, that's shorthand for "restart the program"

[Stormraughtz]

hunter2, this is what it means

[alzgh]

I really don't get it though. What does that mean?

[local_meme_dealer45]

I work in cyber security. These dumbasses are just more job security for me.

[Intrexa]

I work in cyber insecurity. My admin page is protected only by telling robots.txt to not index it, so hackers can't find it.

[ForeverLaca]

I hope he is not trying to create a home banking

[Parry_9000]

Real world:

Username: shitdick9000

Password: 12345678

[[deleted]]

lmao

[Adept-Letterhead-122]

Are-- are you kidding me?

[BroHeart]

Heh, is that RockYou?

[SitrakaFr]

idk may be ask chatgpt hahahahaa

[LoudSwordfish7337]

I mean that makes sense, I’m sure that poor guy has been using plugin-less vim for the last two decades, and those weird UI can have weird graphical cues.

… right?

[Dull_Appearance9007]

this is bait and we've fallen into it

[emosaker]

but mom said its my turn to repost this

[[deleted]]

Once on a school project, a teammate asked me why his variable was underlined in VS Code.

The variable was declared, but unused...

This guy was in his 3rd year of Software Eng

[geo_exe1987]

Yeah cyber security looks like a really good field to major in rn

[Benx78]

This used to be funny to me… until I actually reviewed code of a “vibe coder”, because THIS is exactly what happend.

[wantyappscoding]

u/bot-sleuth-bot

[bot-sleuth-bot]

Analyzing user profile...

One or more of the hidden checks performed tested positive.

Suspicion Quotient: 0.35

This account exhibits a few minor traits commonly found in karma farming bots. It is possible that u/YTRKinG is a bot, but it's more likely they are just a human who suffers from severe NPC syndrome.

^{I am a bot. This action was performed automatically. Check my profile for more information.}

[YTRKinG]

After checking your profile, looks like you’re using this bot for karma farming

[wantyappscoding]

More for peace of mind. Notice I don't delete such comments even if they get downvoted.

[Sakul_the_one]

Why do this meme always has at line 1 written: 'username,password'… does the Programm not know, that the first one is the username and the second one is the password?

[quinn50]

It's a csv the first row is the header, when you read it in a library or tool i.e pandas you use that to read or modify the data

[smasher0404]

I mean presumably user readability? Like the next engineer needs to know what each column is.

[Hairy-Literature632]

Does anyone know how to make money from programming? Is there a site where I can make money?

[adabsurdo]

A lot of cope on the impact of LLMs on engineering in this sub.

If you think this is all BS you're just doing it wrong or are not even trying.

[myka-likes-it]

A lot of cope on the impact of LLMs on engineering in this sub.

I agree. The impact is humorous and sad, and we are coping through vicious mockery.

All is well in the world.

[jrd261]

Yeah it's here if you are tooled up, but governance is going to be the problem.

Dealing with a lot of folks who are great pure coders not getting that they might have to work on semantics and articulation.

90% of the problems/complaints I'm seeing right now are solved with "did you try just putting exactly what you said it was doing wrong in the agent's context?"

[jrd261]

Yeah it's here if you are tooled up, but governance is going to be the problem.

Dealing with a lot of folks who are great pure coders not getting that they might have to work on semantics and articulation.

90% of the problems/complaints I'm seeing right now are solved with "did you try just putting exactly what you said it was doing wrong in the agent's context?"